Deployment Architecture

New index not showing in admin console

Sageth
New Member

I created a bunch of new, custom indexes (i.e. index=myApp) that go to a new path and restarted the indexers. The paths were created without any problem and all seems to be well.

I then added index=myApp on the forwarders and recycled splunkd and splunkweb services, but it still seems to be going to main instead of my new index.

A few things that I've noticed:

  • In admin, I don't see the new index to assign to the "Indexes searched by default"
  • In Settings -> Data -> Indexes, I don't see the new index there either. I could try to create it, but I don't want to cause other problems along the way.

Any thoughts?

Tags (1)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

All indexes have to be created on Indexer. If you want to access the Indexes created on Indexer from Forwarder (or Search Head) UI, then you would have to create indexes with similar name on Forwarder(or Search Head). These indexes on Forwarders will not store data but they are required to be created to appear in dropdown on management views.

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

All indexes have to be created on Indexer. If you want to access the Indexes created on Indexer from Forwarder (or Search Head) UI, then you would have to create indexes with similar name on Forwarder(or Search Head). These indexes on Forwarders will not store data but they are required to be created to appear in dropdown on management views.

stath002
Path Finder

So just add your indexes.conf that goes on the indexers to the SH you are saying? Or does it have to be done via the UI?

0 Karma

sloshburch
Splunk Employee
Splunk Employee

UI just edits the conf files. You might want to explore a way to have the same indexes.conf that is deployed to the indexers sent to the SHs so you keep a consistent list. Not required, but a good thing to consider.

0 Karma

stath002
Path Finder

OK cool thats what I thought I just wanted to double check 🙂

0 Karma

Sageth
New Member

Thanks, not having the path on the search head was the part I was missing. Didn't realize it had to be there, even if it wasn't used.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...